Abstract:The exponential expansion of Internet interconnectivity has led to a dramatic increase in cyber-attack alerts, which contain a considerable proportion of false positives. The overwhelming number of false positives cause tremendous resource consumption and delay responses to the really severe incidents, namely, alert fatigue. To cope with the challenge from alert fatigue, we focus on enhancing the capability of detectors to reduce the generation of false alerts from the detection perspective. The core idea of our work is to train a machine-learning-based detector to grasp the empirical intelligence of security analysts to estimate the feasibility of an incoming HTTP request to cause substantial threats, and integrate the estimation into the detection stage to reduce false alarms. To this end, we innovatively introduce the concept of attack feasibility to characterize the composition rationality of an inbound HTTP request as a feasible attack under static scrutinization. First, we adopt a fast request-reorganization algorithm to transform an HTTP request into the form of interface:payload pair for further alignment of structural components which can reveal the processing logic of the target program. Then, we build a dual-channel attention-based circulant convolution neural network (DualAC2NN) to integrate the attack feasibility estimation into the alert decision, by comprehensively considering the interface sensitivity, payload maliciousness, and their bipartite compatibility. Experiments on a real-world dataset show that the proposed method significantly reduces invalid alerts by around 86.37% and over 61.64% compared to a rule-based commercial WAF and several state-of-the-art methods, along with retaining a detection rate at 97.89% and a lower time overhead, which indicates that our approach can effectively mitigate alert fatigue from the detection perspective.

IHFM: An Improved Hierarchical Filtering Method for Multi-source malicious alerts

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

Industrial control network security situation awareness based on improved C-SVC

Multi-source Alert Data Understanding for Security Semantic Discovery Based on Rough Set Theory.

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

DualAC2NN: Revisiting and Alleviating Alert Fatigue from the Detection Perspective

Network Security Situation Awareness Technology Based on Multi-source Heterogeneous Data

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

A network security situational awareness model based on multi-source heterogeneous sensors

A Multilevel Fire Detection Platform Based on Multi-Source Heterogeneous Information Fusion

Alert reduction for network intrusion detection

Discovering Anomaly on the Basis of Flow Estimation of Alert Feature Distribution

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Research on Intrusion Detection Based on an Improved GHSOM

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Online Parallel Attack Detection Method for Industrial Control based on Multi-bandpass Filter

An alert correlating algorithm based on multi-step attack path graphs:MSACA

A novel intrusion detection scheme for network-attached storage based on multisource information fusion

BR-HIDF: An Anti-Sparsity and Effective Host Intrusion Detection Framework Based on Multi-Granularity Feature Extraction

Towards Scalable and Robust Distributed Intrusion Alert Fusion with Good Load Balancing.

Introducing a New Alert Data Set for Multi-Step Attack Analysis